openwrt luci vulnerabilities

Newest CVEs

• CVE-2026-55897

  luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root

  openwrt · luci

  High8.8
• CVE-2026-62381

  luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow

  openwrt · luci

  Medium6.9
• CVE-2026-72842

  OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass

  openwrt · luci

  Critical9.4
• CVE-2026-72841

  luci-app-openvpn Path Traversal RCE via instance_name2

  openwrt · luci

  Critical9.4
• CVE-2026-72840

  OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write

  openwrt · luci

  High8.7
• CVE-2026-69096

  OpenWrt luci-app-dockerman Read ACL Remote Code Execution

  openwrt · luci

  High8.7
• CVE-2026-69095

  OpenWrt luci-app-bmx7 Path Traversal via bmx7-info

  openwrt · luci

  High8.7
• CVE-2026-68583

  luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name

  openwrt · luci

  Medium5.1
• CVE-2026-67352

  luci-app-https-dns-proxy Stored XSS via resolver_url

  openwrt · luci

  Medium6.8
• CVE-2026-61876

  LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting

  openwrt · luci

  Critical9.4